---
id: CVE-2026-57956
title: >-
  SigNoz < 0.133.0 - Cross-Organization Insecure Direct Object Reference in
  Alert Rules
summary: >-
  SigNoz before 0.133.0 contains a broken access control vulnerability that
  allows authenticated users to access other organizations' alert rules by
  supplying a target rule UUID, as the alert rule store predicates fail to
  filter by organiz…
severity: medium
cvss: 6.4
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L'
cvssSource: cna
cwe:
  - CWE-639
vendor: SigNoz
product: signoz
affected:
  - signoz < 0.133.0
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-06-29T19:22:20.395999Z'
exploitAvailable: true
published: '2026-06-29'
updated: '2026-11-08'
sourceUpdated: '2026-11-08T14:06:41.099Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-57956'
references:
  - url: 'https://github.com/SigNoz/signoz/issues/11830'
    label: Researcher Disclosure
  - url: 'https://github.com/SigNoz/signoz/releases/tag/v0.133.0'
    label: signoz 0.133.0 Release Notes
  - url: 'https://github.com/SigNoz/signoz/pull/12117'
    label: Pull Request
  - url: >-
      https://www.vulncheck.com/advisories/signoz-cross-organization-insecure-direct-object-reference-in-alert-rules
tags:
  - cve.org
  - exploit-available
epss: 0.00353
epssPercentile: 0.29176
ingestedAt: '2026-11-08T14:51:22.315Z'
---

## Overview

SigNoz before 0.133.0 contains a broken access control vulnerability that allows authenticated users to access other organizations' alert rules by supplying a target rule UUID, as the alert rule store predicates fail to filter by organization ID. Attackers can read, edit, and delete alert rules belonging to other organizations by exploiting the missing tenant isolation check, bypassing multi-tenant access controls.

## Affected

- `signoz < 0.133.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.